River Falls Medical Clinic Data Breach (2012)

Perhaps the Office for Civil Rights (OCR) was so specific with subcontractor language and breach notification amendments in the HIPAA omnibus rule for good reason. Similar to many recent healthcare data breaches, River Falls Medical Clinic notified about 2,400 clients of a breach that was tied to a subcontractor, in this case an outside cleaning service employee who stole patient records during the summer of 2012.